CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NCVE-2024-29888
Medium (5.4) in saleor saleor. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in saleor 3.14.61, 3.15.37, 3.16.34.
Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address as click-and-collect address. This issue has been patched in versions: `3.14.61`, `3.15.37`, `3.16.34`, `3.17.32`, `3.18.28`, `3.19.15`.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWE
- CWE-359
- Published
- Modified
- Record from
- the NVD, synced
Affected
- saleor:saleor
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mrj3-f2h4-7w45 | PyPI | saleor | >=3.14.56 <3.14.61 | 3.14.61 |
| GHSA-mrj3-f2h4-7w45 | PyPI | saleor | >=3.15.31 <3.15.37 | 3.15.37 |
| GHSA-mrj3-f2h4-7w45 | PyPI | saleor | >=3.16.27 <3.16.34 | 3.16.34 |
| GHSA-mrj3-f2h4-7w45 | PyPI | saleor | >=3.17.25 <3.17.32 | 3.17.32 |
| GHSA-mrj3-f2h4-7w45 | PyPI | saleor | >=3.18.19 <3.18.28 | 3.18.28 |
| GHSA-mrj3-f2h4-7w45 | PyPI | saleor | >=3.19.5 <3.19.15 | 3.19.15 |
| PYSEC-2026-1890 | PyPI | saleor | >=3.14.56 <3.14.61 >=3.15.31 <3.15.37 >=3.16.27 <3.16.34 >=3.17.25 <3.17.32 >=3.18.19 <3.18.28 >=3.19.5 <3.19.15 | 3.14.61, 3.15.37, 3.16.34, 3.17.32, 3.18.28, 3.19.15 |
References
- https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761
- https://github.com/saleor/saleor/commit/39abb0f4e4fe6503f81bfbb871227e4f70bcdd5c
- https://github.com/saleor/saleor/commit/47cedfd7d6524d79bdb04708edcdbb235874de6b
- https://github.com/saleor/saleor/commit/997f7ea4f576543ec88679a86bfe1b14f7f2ff26
- https://github.com/saleor/saleor/commit/b7cecda8b603f7472790150bb4508c7b655946d4